Claims 

What is claimed is: 

1 1 . A method for establishing a secret to authenticate a user comprising the steps of: 

2 receiving a secret pattern on a graphical interface, wherein the secret pattern comprises a 

3 sequence of discrete graphical choices; 

4 converting each discrete graphical choice in the sequence of discrete graphical choices 

5 into a value to produce a sequence of values, wherein the sequence of values corresponds to the 

6 sequence of discrete graphical choices; 

7 selecting a codeword from a plurality of codewords for each value in the sequence of 

8 values to generate a sequence of codewords, the plurality of codewords being associated with an 

9 error-correcting code; 

f 0 calculating a security value of a security parameter from the sequence of codewords; and 

IS comparing the security value of the security parameter to a threshold value. 

ffl 2. The method of claim 1 wherein the security parameter is entropy. 

□ 3. The method of claim 1 wherein the security parameter is minentropy. 

H 4. The method of claim 1 further comprising the step of rejecting the secret pattern if the 

vA security value of the security parameter does not meet or exceed the threshold value. 

Q 5. The method of claim 1 further comprising, if the security value of the security parameter 

2 meets or exceeds the threshold value, the steps of: 

3 calculating an offset between each value in the sequence of values and the corresponding 

4 codeword in the sequence of codewords to generate a sequence of offsets; and 

5 hashing the sequence of codewords to produce a hash of the sequence of codewords. 

1 6. The method of claim 5 further comprising storing the sequence of offsets for use in 

2 authenticating a user. 

1 7. The method of claim 6 further comprising storing the hash of the sequence of codewords 

2 for use in authenticating a user. 



-39- 



1 8. The method of claim 6 further comprising transmitting the hash of the sequence of 

2 codewords to an authentication device for use in authenticating a user, 

1 9. A method for establishing a secret to authenticate a user comprising the steps of: 

2 receiving a secret pattern on a graphical interface, wherein the secret pattern comprises a 

3 sequence of discrete graphical choices; 

4 converting each discrete graphical choice in the sequence of discrete graphical choices 

5 into a value to produce a sequence of values, wherein the sequence of values corresponds to the 

6 sequence of discrete graphical choices; 

7 selecting a codeword from a plurality of codewords for each value in the sequence of 

8 values to generate a sequence of codewords, the plurality of codewords being associated with an 

9 error-correcting code; 

II calculating an offset between each value in the sequence of values and the corresponding 

§fi codeword in the sequence of codewords to generate a sequence of offsets; and 

ff| hashing the sequence of codewords to produce a hash of the sequence of codewords. 

ui 1 0 The method of claim 9 wherein a discrete graphical choice in the sequence of discrete 

72 graphical choices comprises a selected point on the graphical interface. 

4 1 1 . The method of claim 10 further comprising the step of displaying an image on the 

|i graphical interface after receiving the selected point on the graphical interface, wherein each 

S3 discrete graphical choice in the sequence of discrete graphical choices is associated with one of a 

4 plurality of images. 

1 12. The method of claim 1 1 further comprising prompting a user by displaying one of the 

2 plurality of images on the graphical interface; and receiving a match pattern on the graphical 

3 interface for comparison with the secret pattern, wherein the match pattern comprises a sequence 

4 of match points. 

1 13. The method of claim 1 2 further comprising, during or after the step of receiving the 

2 match pattern on the graphical interface, displaying the selected point associated with the image 

3 on the graphical interface. 
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1 14. The method of claim 1 3 further comprising, during or after the step of receiving the 

2 match pattern on the graphical interface, displaying a line from a match point to the selected 

3 point associated with the image on the graphical interface. 

1 15. The method of claim 1 0 further comprising providing at least one memory cue by 

2 presenting the at least one memory cue in response to a point on the image on the graphical 

3 interface being highlighted. 

1 16. The method of claim 1 5 further comprising associating a first icon from a plurality of 

2 icons with a first point on the image on the graphical interface by displaying the first icon in 

3 response to the first point being highlighted; and associating a second icon from the plurality of 

4 icons with a second point on the image on the graphical interface by displaying the second icon 
? 4 in response to the second point being highlighted. 

iti 17. The method of claim 1 0 further comprising highlighting, for each discrete graphical 

li choice in the sequence of discrete graphical choices, a plurality of points on the graphical 

s fjt interface as alternative graphical choices. 

$ 1 18. The method of claim 9 further comprising storing the sequence of offsets for use in 
authenticating a user. 

y 19. The method of claim 9 further comprising storing the hash of the sequence of codewords 

M2 for use in authenticating a user. 

1 20. A method for authenticating a user comprising the steps of: 

2 receiving an input pattern on a graphical interface, wherein the input pattern comprises a 

3 sequence of discrete graphical choices; 

4 converting each discrete graphical choice in the sequence of discrete graphical choices 

5 into an input value to produce a sequence of input values, wherein the sequence of input values 

6 corresponds to the sequence of discrete graphical choices; 

7 retrieving a sequence of offsets; 

8 summing each input value from the sequence of input values with the corresponding 

9 offset from the sequence of offsets to generate a sequence of intermediate values; 
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10 selecting a codeword from a plurality of codewords for each intermediate value in the 

1 1 sequence of intermediate values to generate a sequence of codewords, the plurality of codewords 

12 being associated with an error-correcting code; 

13 hashing the sequence of codewords to produce a hash of the sequence of codewords; and 

14 authenticating a user if the hash matches a stored hash. 

1 21. The method of claim 20 further comprising, prior to the authenticating step, the step of 

2 retrieving a stored hash. 

1 22. The method of claim 20 further comprising, prior to the authenticating step, the step of 

2 transmitting the hash to an authentication device. 

1 23 . The method of claim 20 wherein each input value in the sequence of input values is a 

l f binary value of fixed length, 

M? 24. The method of claim 20 wherein a discrete graphical choice in the sequence of discrete 

jjf graphical choices comprises a selected region on the graphical interface. 

H 25. The method of claim 20 wherein a discrete graphical choice in the sequence of discrete 

C3 graphical choices comprises a selected point on the graphical interface. 

j Hi 26. The method of claim 25 further comprising displaying an image on the graphical interface 

M2 after receiving the selected point on the graphical interface, wherein each discrete graphical 

3 choice in the sequence of discrete graphical choices is associated with one of a plurality of 

4 images. 

1 27. The method of claim 25 further comprising associating an icon from a plurality of icons 

2 with a point on the graphical interface by displaying the icon when the point is highlighted. 

1 28. The method of claim 20 wherein the graphical interface displays a fractal image. 

1 29. The method of claim 20 wherein a discrete graphical choice in the sequence of discrete 

2 graphical choices comprises a selected icon from a plurality of icons on the graphical interface. 

1 30. The method of claim 29 wherein the icon on the graphical interface represents a face. 
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1 31. The method of claim 20 further comprising the step of allowing access to a resource in 

2 response to the step of authenticating the user. 

1 32. The method of claim 3 1 wherein the step of allowing access to the resource comprises 

2 allowing access to at least one of a hardware device, a computer system, a portable computer, a 

3 software application, a database, and a physical location. 

1 33 . An apparatus for establishing a secret to authenticate a user, the apparatus comprising: 

2 a graphical interface capable of receiving graphical input, the graphical interface 

3 receiving a secret pattern as graphical input, the secret pattern comprising a sequence of discrete 

4 graphical choices; 

5 a converter in signal communication with the graphical interface, the converter converting 
_6 each discrete graphical choice in the sequence of discrete graphical choices into a value to 

# produce a sequence of values, wherein the sequence of values corresponds to the sequence of 
discrete graphical choices; 

a codeword generator in signal communication with the converter, the codeword 

CpD generator producing a sequence of codewords by applying a decoding function of an error 

Tl correcting code to each value in the sequence of values; 

a security calculator in signal communication with the codeword generator, the security 

f|0 calculator calculating a security value of a security parameter from the sequence of codewords; 

ffy and 

' f t5 a comparator in signal communication with the security calculator, the comparator 

16 comparing the security value of the security parameter to a threshold value. 

1 34, The apparatus of claim 33 wherein the security parameter is entropy. 

1 35. The apparatus of claim 33 wherein the security parameter is minentropy. 

1 36. The apparatus of claim 33 further comprising: 

2 an offset calculator in signal communication with the comparator, the offset calculator 

3 calculating, if the security value of the security parameter meets or exceeds the threshold value, 

4 an offset between each value in the sequence of values and the corresponding codeword in the 

5 sequence of codewords to generate a sequence of offsets; and 
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6 a hasher in signal communication with the comparator, the hasher applying a hash 

7 function to the sequence of codewords to produce a hash of the sequence of codewords if the 

8 security value of the security parameter meets or exceeds the threshold value. 

1 37. The apparatus of claim 36 further comprising a memory element in signal communication 

2 with the offset calculator, the memory element storing the sequence of offsets for use in 

3 authenticating a user. 

1 38. The apparatus of claim 37 wherein the memory element is in signal communication with 

2 the hasher and wherein the memory element stores the hash of the sequence of codewords for use 

3 in authenticating a user. 

1 39. An apparatus for establishing a secret to authenticate a user, the apparatus comprising: 
Q a graphical interface capable of receiving graphical input, the graphical interface 

gS receiving a secret pattern as graphical input, the secret pattern comprising a sequence of discrete 

Id graphical choices; 

t{l a converter in signal communication with the graphical interface, the converter converting 

f% each discrete graphical choice in the sequence of discrete graphical choices into a value to 

L7 produce a sequence of values, wherein the sequence of values corresponds to the sequence of 

i^S discrete graphical choices; 

[h? a codeword generator in signal communication with the converter, the codeword 

Tffl generator producing a sequence of codewords by applying a decoding function of an error 

1 1 correcting code to each value in the sequence of values; 

12 an offset calculator in signal communication with the codeword generator, the offset 

13 calculator calculating an offset between each value in the sequence of values and the 

14 corresponding codeword in the sequence of codewords to generate a sequence of offsets; and 

15 a hasher in signal communication with the codeword generator, the hasher applying a 

16 hash function to the sequence of codewords to produce a hash of the sequence of codewords. 

1 40. The apparatus of claim 39 wherein a discrete graphical choice in the sequence of discrete 

2 graphical choices comprises a selected point on the graphical interface. 
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1 41 . The apparatus of claim 40 further comprising a point generator in signal communication 

2 with the graphical interface, the point generator highlighting a plurality of points on the graphical 

3 interface as alternative graphical choices for each discrete graphical choice in the sequence of 

4 discrete graphical choices, 

1 42. The apparatus of claim 41 further comprising a memory element in signal communication 

2 with the graphical interface, the memory element containing a plurality of images and a sequence 

3 of images, wherein receiving a discrete graphical choice in the sequence of discrete graphical 

4 choices triggers the graphical interface to display the next image in the sequence of images from 

5 the plurality of images contained in the memory element. 

1 43. The apparatus of claim 42 further comprising: 

2 a training logic element in signal communication with the graphical interface, the training 
^0 logic element prompting a user to enter a match pattern upon receiving the secret pattern by 

yj causing the graphical interface to display the first image in the sequence of images, wherein the 

^5 match pattern is a sequence of match points; and 

p a comparator in signal communication with the graphical interface, the comparator 

comparing the match pattern to the secret pattern. 

U| 44 b The apparatus of claim 43 wherein the training logic element, during or after receiving a 

\k match point in the sequence of match points on the graphical interface, causes the graphical 
interface to highlight the selected point associated with the image on the graphical interface. 

1 45 The apparatus of claim 43 wherein the training logic element, during or after receiving a 

2 match point in the sequence of match points on the graphical interface, causes the graphical 

3 interface to display a line from the match point to the selected point associated with the image on 

4 the graphical interface. 

1 46. The apparatus of claim 39 further comprising a memory element in signal communication 

2 with the offset calculator, the memory element storing the sequence of offsets from the offset 

3 calculator for use in authenticating a user. 
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1 47. The apparatus of claim 39 wherein the memory element is in signal communication with 

2 the hasher, the memory element storing the hash of the sequence of codewords from the hasher 

3 for use in authenticating a user. 

1 48. An apparatus for authenticating a user, the apparatus comprising: 

2 a graphical interface capable of receiving graphical input, the graphical interface 

3 receiving an input pattern as graphical input, the input pattern comprising a sequence of discrete 

4 graphical choices; 

5 a converter in signal communication with the graphical interface, the converter converting 

6 each discrete graphical choice in the sequence of discrete graphical choices into an input value to 

7 produce a sequence of input values, wherein the sequence of input values corresponds to the 

8 sequence of discrete graphical choices; 

3 a memory element in signal communication with a summer, the memory element 

il containing a sequence of offsets; 

H the summer in signal communication with the converter and the memory element, the 

Wi summer summing each input value from the sequence of input values with the corresponding 

S§ offset from the sequence of offsets to generate a sequence of intermediate values; 
li a codeword generator in signal communication with the summer, the codeword generator 

m producing a sequence of codewords by applying a decoding function of an error correcting code 

to each intermediate value in the sequence of intermediate values; and 
jt? a hasher in signal communication with the codeword generator, the hasher applying a 

18 hash function to the sequence of codewords to produce a hash of the sequence of codewords for 

1 9 use in authenticating a user. 

1 49. The apparatus of claim 48 further comprising a comparator in signal communication with 

2 the hasher, the comparator comparing the hash of the sequence of codewords to a stored hash and 

3 producing an authentication signal if the hash of the sequence of codewords matches the stored 

4 hash. 

1 50. The apparatus of claim 49 wherein the authentication signal enables access to a resource. 
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1 51. The apparatus of claim 50 wherein the authentication signal enables access to at least one 

2 of a hardware device, a computer system, a portable computer, a software application, a database, 

3 and a physical location. 

1 52. The apparatus of claim 48 further comprising a communication system in signal 

2 communication with the hasher, the communication system transmitting the hash of the sequence 

3 of codewords to an authentication device and receiving an authentication signal from the 

4 authentication device if the hash of the sequence of codewords matches the stored hash. 

1 53 . The apparatus of claim 48 wherein a discrete graphical choice in the sequence of discrete 

2 graphical choices comprises a selected region on the graphical interface. 

l 54 . The apparatus of claim 48 wherein a discrete graphical choice in the sequence of discrete 

'HI graphical choices comprises a selected point on the graphical interface. 

55 . The apparatus of claim 48 further comprising a logic element in signal communication 

l| with the graphical interface, the logic element causing the graphical interface to display a new 

% image in response to the graphical interface receiving a discrete graphical choice from the 

L4 sequence of discrete graphical choices, wherein the sequence of discrete graphical choices 

US corresponds to a sequence of images. 

% 56. The apparatus of claim 48 further comprising a logic element in signal communication 

hi with the graphical interface, the logic element causing the graphical interface to display at least 

3 one memory cue in response to a point on the graphical interface being highlighted. 

1 57. The apparatus of claim 56 wherein the logic element causes a first icon from a plurality of 

2 icons to be displayed on the graphical interface in response to a first point on the image on the 

3 graphical interface being highlighted; and wherein the logic element causes a second icon from 

4 the plurality of icons to be displayed on the graphical interface in response to a second point on 

5 the image on the graphical interface being highlighted. 
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1 58. The apparatus of claim 48 wherein a discrete graphical choice in the sequence of discrete 

2 graphical choices comprises a selected icon from a plurality of icons displayed on the graphical 

3 interface. 

1 59. A method for generating a cryptographic secret from a visual password, the method 

2 comprising the steps of: 

3 receiving a secret pattern on a graphical interface, wherein the secret pattern comprises a 

4 sequence of discrete graphical choices; 

5 converting each discrete graphical choice in the sequence of discrete graphical choices 

6 into a value to produce a sequence of values, wherein the sequence of values corresponds to the 

7 sequence of discrete graphical choices; 

8 selecting a codeword from a plurality of codewords for each value in the sequence of 

C| values to generate a sequence of codewords, the plurality of codewords being associated with an 

li error-correcting code; and 

[y manipulating the sequence of codewords to produce a cryptographic secret. 

01 60. The method of claim 59 further comprising calculating an offset between each value in 

72 the sequence of values and the corresponding codeword in the sequence of codewords to generate 

H a sequence of offsets for use in re-generating the secret. 

W 6 1 . The method of claim 59 wherein the selecting step comprises applying a decoding 

tk function of an error-correcting code to each value in the sequence of values to generate a 
3 sequence of codewords. 

1 62. The method of claim 59 wherein the manipulation step comprises applying a hash 

2 function to the sequence of codewords. 

1 63. The method of claim 59 further comprising using the cryptographic secret as an 

2 encryption key. 

64. The method of claim 59 further comprising using the cryptographic secret in a digital 
signature algorithm or an identification algorithm. 
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